samiandClaude Sonnet 5
dab071c41a
The extension's fallback transport (docs/05 §4). veloxd now also listens on 127.0.0.1, first free port in 52000-52016, and writes it to <runtime>/ws.port (0600). - rpc/ws_frame — RFC 6455 frame codec. Incremental; reassembles continuation frames; enforces "client frames MUST be masked" (§5.1); caps a reassembled message at 8 MiB. This is the attacker-adjacent parser, so it has its own test table. - rpc/ws_handshake — HTTP upgrade parse, Sec-WebSocket-Accept (SHA-1 + base64 via libcrypto), and the two non-negotiable checks: an Origin header must be present and must be moz-extension:// (a page cannot pair). Version must be 13. - rpc/ws_server — per-connection Handshake -> Open state machine on the shared EventLoop. Token gate: session.pair mints a token behind the approver + rate limiter; session.hello must present a valid one; every other method is -32002 until authed. Privileged methods are refused -32003 by the generated dispatch(). Ping -> Pong; Close echoed. session.hello major-version mismatch -> -32001. - rpc/pairing — PairingApprover interface + EnvAutoApprover dev stub (approves iff VELOX_PAIR_AUTO=1); PairingRateLimiter (5 failures / 60 s per origin, then 60 s lockout -> -32014, survives reconnect); a four-digit code generator. - store/pairings — the pairings table: create() returns the plaintext token once and stores only its SHA-256; find_active_by_token, touch, revoke, list_active. - util/crypto — sha1 / sha256_hex / base64 / random_token over libcrypto. - store/sqlite — pin the DB file (and -wal/-shm) to 0600. - runtime_dir — resolve_data_dir() for $XDG_DATA_HOME/velox (velox.db). - main.cpp — opens + migrates velox.db, starts both transports; a WS bind failure is logged, not fatal (capture must fail open, the Unix socket still serves the GUI/CLI). Real gap, flagged not hidden: the pairing prompt is EnvAutoApprover for now — a GUI dialog / desktop notification is build step 7. Pairing needs VELOX_PAIR_AUTO=1 until then. Tests (ASan+UBSan and TSan clean): veloxd.ws_frame (codec + handshake vectors incl. the RFC 6455 §1.3 accept sample), veloxd.pairings (token create/find/revoke, hash-not-token, rate-limit window + lockout + per-origin isolation + success reset), veloxd.ws_server (full flow: 101 handshake, -32002 gate, deny-then-approve pairing, hello-with-token, -32003 privileged refusal, real download.list). 27 daemon/cli tests green; full tree green. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig
88 lines
3.2 KiB
C++
88 lines
3.2 KiB
C++
// The pairings table + the pairing rate limiter.
|
|
|
|
#include <string>
|
|
|
|
#include "check.hpp"
|
|
#include "rpc/pairing.hpp"
|
|
#include "store/migrations.hpp"
|
|
#include "store/pairings.hpp"
|
|
#include "store/sqlite.hpp"
|
|
|
|
using namespace velox::daemon;
|
|
|
|
void run() {
|
|
// --- store: create -> find-by-token -> revoke ---------------------------------
|
|
{
|
|
auto db = store::Db::open(":memory:");
|
|
CHECK(db.has_value());
|
|
if (!db) return;
|
|
CHECK(store::migrate_to_head(*db).has_value());
|
|
|
|
store::Pairings p(*db);
|
|
auto created = p.create("moz-extension://abc", "Velox for Firefox", "2026-09-10T00:00:00Z");
|
|
CHECK(created.has_value());
|
|
if (!created) return;
|
|
CHECK(created->token.size() >= 40); // 32 bytes base64url, unpadded
|
|
CHECK(!created->pairing_id.empty());
|
|
|
|
// The plaintext token is not in the DB — only its hash.
|
|
auto st = db->prepare("SELECT count(*) FROM pairings WHERE token_sha256 = ?1");
|
|
CHECK(st.has_value());
|
|
CHECK(st->bind(1, std::string_view(created->token)).has_value());
|
|
auto row = st->step();
|
|
CHECK(row.has_value() && *row);
|
|
CHECK_EQ(st->column_int(0), 0); // token itself never stored
|
|
|
|
auto found = p.find_active_by_token(created->token);
|
|
CHECK(found.has_value());
|
|
CHECK(found->has_value());
|
|
if (found && *found) CHECK_EQ((*found)->origin, std::string("moz-extension://abc"));
|
|
|
|
auto missing = p.find_active_by_token("not-the-token");
|
|
CHECK(missing.has_value() && !missing->has_value());
|
|
|
|
auto revoked = p.revoke(created->pairing_id, "2026-09-10T01:00:00Z");
|
|
CHECK(revoked.has_value() && *revoked == true);
|
|
|
|
auto after = p.find_active_by_token(created->token);
|
|
CHECK(after.has_value() && !after->has_value()); // revoked -> not active
|
|
|
|
auto revoke_again = p.revoke(created->pairing_id, "2026-09-10T02:00:00Z");
|
|
CHECK(revoke_again.has_value() && *revoke_again == false);
|
|
}
|
|
|
|
// --- rate limiter: 5 failures, then a lockout with retryAfter -----------------
|
|
{
|
|
rpc::PairingRateLimiter rl;
|
|
using Clock = rpc::PairingRateLimiter::Clock;
|
|
const auto t0 = Clock::now();
|
|
|
|
for (int i = 0; i < 5; ++i) {
|
|
CHECK(rl.check("origin-a", t0).allowed);
|
|
rl.record_failure("origin-a", t0);
|
|
}
|
|
const auto d = rl.check("origin-a", t0);
|
|
CHECK(!d.allowed);
|
|
CHECK(d.retry_after_sec > 0 && d.retry_after_sec <= 61);
|
|
|
|
// A different origin is unaffected — the lockout is per-origin.
|
|
CHECK(rl.check("origin-b", t0).allowed);
|
|
|
|
// Still locked 30 s later; clear after the lockout elapses.
|
|
CHECK(!rl.check("origin-a", t0 + std::chrono::seconds(30)).allowed);
|
|
CHECK(rl.check("origin-a", t0 + std::chrono::seconds(121)).allowed);
|
|
|
|
// A success wipes the origin's history.
|
|
rl.record_failure("origin-c", t0);
|
|
rl.record_failure("origin-c", t0);
|
|
rl.record_success("origin-c");
|
|
for (int i = 0; i < 4; ++i) {
|
|
CHECK(rl.check("origin-c", t0).allowed);
|
|
rl.record_failure("origin-c", t0);
|
|
}
|
|
CHECK(rl.check("origin-c", t0).allowed); // only 4 since the reset
|
|
}
|
|
}
|
|
|
|
TEST_MAIN()
|